StoreFbpSubscriber sets the _fbp cookie on every response, also without pixels

[loevgaard]

Problem

StoreFbpSubscriber runs on kernel.response for every main request and, when consent is granted, writes the _fbp cookie whenever it is missing or older than two hours. It does so for

• JSON/API responses, redirects, 404/500 pages, assets served through Symfony;
• applications with zero pixels configured (the pixel provider is not consulted, unlike AddLibraryToTagBagSubscriber which checks getPixels());
• responses that would otherwise be cacheable by a shared cache: any Set-Cookie header makes Symfony HttpCache, Varnish and CDNs treat the response as uncacheable.

When client_side is enabled the browser pixel writes the same cookie anyway, so the server-side cookie only matters for a visitor's very first event.

Also, the private method setCookie() (src/EventSubscriber/StoreFbpSubscriber.php:68) is a predicate; its name reads as if it performs the write.

Suggested fix

• Skip when the pixel provider returns no pixels, as the library subscriber already does.
• Skip redirects ($response->isRedirection()) and non-successful responses.
• Expose a switch so operators can turn server-side cookies off when the browser pixel handles them:

  setono_meta_conversions_api:
      cookies:
          fbp: true
          fbc: true

• Rename setCookie() to shouldSetCookie().
• Share cookie names and the 90-day lifetime between StoreFbpSubscriber and StoreFbcSubscriber (constants or a small cookie factory), see also Allow configuring the cookie domain for _fbp/_fbc #29.

Tests

Unit tests for StoreFbpSubscriber: no cookie → set; fresh cookie → not set; cookie older than two hours → renewed; sub-request → ignored; consent denied → ignored; no pixels → ignored.